Reported by 5 outlets

Timeline

1. original reporting

   BragJack attacks hijack AI browser agents through malicious extensions

   bleepingcomputer.com · 24d ago · September 19th, 2026

   Security researcher Gal Weizman of Forever Security has disclosed a new attack technique that can hijack the AI assistants built into popular browsers using a single malicious browser extension. Dubbed BragJack, the proof-of-concept was demonstrated against five Chromium-based browsers or browser assistants: Google Chrome's Gemini Live, Perplexity Comet, Microsoft Edge, Opera Neon, and Anthropic's Claude in Chrome. The research earned more than $20,000 in bug bounties from the five vendors, ranging from $600 to $7,000, and produced two CVEs. The attack requires the malicious extension to already be installed in the victim's browser. Once it is, the researcher shows the abuse can run without user interaction, letting an extension control an AI browser agent and abuse its existing privileges to access sensitive information or act on the victim's behalf. Both Google and Microsoft have since resolved the flaws they were assigned. Abusing trusted browser components The attacks exploit the way AI assistants are increasingly wired into browsers and handed browser-level capabilities. In his writeup, Weizman describes these systems as having a "brain" and a "body." The AI model processes instructions and decides what should happen. A privileged browser component then performs the actions, such as accessing tabs, reading content, taking screenshots, or interacting with websites. The problem, according to the researcher, is that browser extensions can manipulate web traffic and pages th

2. update from forever.security

   BragJack - $20K in bounty rewards from Anthropic, Perplexity, Google, Microsoft and Opera

   forever.security · 27d ago · September 16th, 2026

   Excited to finally share my recent work, where I managed to hack Chrome, Comet, Edge, Opera and Claude in Chrome using one single browser extension 2 CVEs & $20,000 in bounties 🙂 Hope you like it! https://forever.security/blog/bragjack-attack-hijacks-every-browser-agent submitted by /u/Content-Winter5328 [link] [comments]

   via reddit r/cybersecurity: BragJack - $20K in bounty rewards from Anthropic, Perplexity, Google, Microsoft and Opera

3. update from securebulletin.com

   BragJack Lets Malicious Extensions Command AI Browser Agents Across Trusted Channels # CyberSecurity https:// securebulletin.com/bragjack-le

   securebulletin.com · 24d ago · September 19th, 2026

   BragJack Lets Malicious Extensions Command AI Browser Agents Across Trusted Channels # CyberSecurity https:// securebulletin.com/bragjack-le

   via Mastodon https://securebulletin.com/bragjack-lets-malicious-extensions-command-ai-browser-agents-across-trusted-channels/

4. mentioned by www.bleepingcomputer.com

   🤖 BragJack: a single malicious browser extension can hijack AI assistants in Chrome, Edge, Opera Neon, Perplexity Comet and Claude in Chrome

   www.bleepingcomputer.com · 23d ago · September 20th, 2026

5. mentioned by www.bleepingcomputer.com

   # BragJack attacks hijack # AI browser agents through malicious extensions https://www. bleepingcomputer.com/news/secu rity/bragjack-attacks

   www.bleepingcomputer.com · 23d ago · September 20th, 2026

6. update from gbhackers.com

   BragJack Attack Hijacks AI Assistants in 5 Popular Browsers With Zero Clicks

   gbhackers.com · 22d ago · September 21st, 2026

   The research, published on September 16 by Gal Weizman of Forever Security, describes a common architectural […] The post BragJack Attack Hijacks AI Assistants in 5 Popular Browsers With Zero Clicks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

7. update from cyberpress.org

   BragJack Attack Lets Browser Extensions Hijack AI Agents Across Chrome, Edge and Comet

   cyberpress.org · 22d ago · September 21st, 2026

   The research demonstrates how a single malicious browser extension could allegedly abuse trusted communication paths between cloud-hosted AI models and privileged browser agents, enabling unauthorized commands, sensitive-data access, and browser-level actions. The findings include CVE-2026-0628 and CVE-2026-55945. The BragJack technique does not depend on traditional prompt injection, where attackers manipulate an existing user prompt with hidden or malicious instructions. Instead, it targets the architecture behind browser AI assistants. AI-enabled browsers commonly separate their assistants into two components. A cloud-based AI service acts as the decision-making layer, while a privileged local browser component executes actions such as accessing webpages, summarizing content, handling tabs, or interacting with browser data. This local component trusts instructions delivered through specific vendor-controlled websites or internal communication channels.